# Zk.Money v1 (Aztec v1) Markdown version of https://ethbeat.org/layer2s/projects/aztecv1 ## Summary **Warning:** This project is archived and no longer maintained. - Total Value Secured: $49.97 (0.00% compared to seven days ago; canonically bridged $49.97, natively minted $0.00, externally bridged $0.00; 0.00% with additional trust assumptions compared to the tokens involved and the Stage assigned to the project's canonical messaging bridge) - TVS by asset: Stablecoins $49.97 (100%) - Past day UOPS: No data - Stage: Stage 2 (Appchain: Aztec v2 is a private rollup that allows users to transfer assets privately. Arbitrary smart contracts are not supported.) - Type: ZK Rollup - Purposes: Payments, Privacy - Host chain: Ethereum ### Risks - Sequencer failure: Self sequence (sentiment: good) - State validation: Validity proofs (SN) (No execution delay; sentiment: good) - Data availability: Onchain (sentiment: good) - Exit window: ∞ (sentiment: good) - Proposer failure: Self propose (sentiment: good) ### About Zk.Money v1 (Aztec v1, or sometimes called Aztec 2.0) is an open source layer 2 network that aims to enable affordable, private crypto payments via zero-knowledge proofs. ### Links - Website: https://aztec.network/ - Bridge: https://old.zk.money - Docs: https://docs.aztec.network/ - Repository: https://github.com/AztecProtocol/aztec-2-bug-bounty - Social: https://twitter.com/aztecnetwork, https://medium.com/aztec-protocol, https://discord.gg/UDtJr9u, https://plonk.cafe/, https://youtube.com/@aztecnetwork - Contracts explorer (Disco): https://disco.ethbeat.org/ui/p/aztec ## Value Secured The interactive TVS charts are shown on [the HTML page](https://ethbeat.org/layer2s/projects/aztecv1#tvs). Token by token: [TVS breakdown](https://ethbeat.org/layer2s/projects/aztecv1/tvs-breakdown). - [TVS chart (JSON)](https://ethbeat.org/api/scaling/tvs/aztecv1?range=max) - [TVS breakdown by token (JSON)](https://ethbeat.org/api/scaling/tvs/aztecv1/breakdown) ## Onchain costs The section shows the operating costs that L2s pay to Ethereum. The interactive costs chart is shown on [the HTML page](https://ethbeat.org/layer2s/projects/aztecv1#onchain-costs). ### Tracked transactions #### State updates - functionCall: 2021-03-03 19:27 UTC - now; currently used; address: [0x737901bea3eeb88459df9ef1BE8fF3Ae1B42A2ba](https://etherscan.io/address/0x737901bea3eeb88459df9ef1BE8fF3Ae1B42A2ba); selector: 0x06011a46; signature: `function processRollup(bytes proofData, bytes signatures, bytes viewingKeys, bytes providerSignature, address provider, address feeReceiver, uint256 feeLimit)` - functionCall: 2021-03-03 19:27 UTC - now; currently used; address: [0x737901bea3eeb88459df9ef1BE8fF3Ae1B42A2ba](https://etherscan.io/address/0x737901bea3eeb88459df9ef1BE8fF3Ae1B42A2ba); selector: 0xd1c65264; signature: `function escapeHatch(bytes proofData, bytes signatures, bytes viewingKeys)` ## Liveness This section shows how "live" the project's operators are by displaying how frequently they submit transactions of the selected type. It also highlights anomalies - significant deviations from their typical schedule. The interactive liveness chart is shown on [the HTML page](https://ethbeat.org/layer2s/projects/aztecv1#liveness). ### Tracked transactions #### State updates - functionCall: 2021-03-03 19:27 UTC - now; currently used; address: [0x737901bea3eeb88459df9ef1BE8fF3Ae1B42A2ba](https://etherscan.io/address/0x737901bea3eeb88459df9ef1BE8fF3Ae1B42A2ba); selector: 0x06011a46; signature: `function processRollup(bytes proofData, bytes signatures, bytes viewingKeys, bytes providerSignature, address provider, address feeReceiver, uint256 feeLimit)` - functionCall: 2021-03-03 19:27 UTC - now; currently used; address: [0x737901bea3eeb88459df9ef1BE8fF3Ae1B42A2ba](https://etherscan.io/address/0x737901bea3eeb88459df9ef1BE8fF3Ae1B42A2ba); selector: 0xd1c65264; signature: `function escapeHatch(bytes proofData, bytes signatures, bytes viewingKeys)` ## Milestones & Incidents - 2026-06-17 (incident): [Escape-hatch verifier exploit](https://www.aztec-labs.com/blog/aztec-2-incident.html). $2.2M of assets are drained by exploiting an unsound verification key. - 2023-07-08: [Aztec operator sunset](https://github.com/AztecProtocol/aztec-v2-ejector/). Aztec stops their rollup operators. Users now have to run the Rollup manually. - 2021-03-15: [Aztec 2.0](https://medium.com/aztec-protocol/launching-aztec-2-0-rollup-ac7db8012f4b). Private Rollup is live on mainnet, allowing user to access DeFi. ## Risk summary **Warning:** On 2026-06-17 the immutable rollup contract was [exploited for ~$2.16M](https://x.com/aztecFND/status/2067511967237939636) (1,158 ETH, ~150k DAI and renBTC) through its emergency escapeHatch() withdrawal function. Ownership of the rollup contract is irrevocably renounced, so it cannot be paused or patched, and Aztec is not running a rollup processor (operator). Aztec stated the affected product is deprecated and unrelated to the current Aztec Network or the AZTEC token. ### Funds can be frozen if 1. the operator refuses to include their transactions and users lack resources to propose blocks themselves. ## Risk analysis **Warning:** On 2026-06-17 the immutable rollup contract was [exploited for ~$2.16M](https://x.com/aztecFND/status/2067511967237939636) (1,158 ETH, ~150k DAI and renBTC) through its emergency escapeHatch() withdrawal function. Ownership of the rollup contract is irrevocably renounced, so it cannot be paused or patched, and Aztec is not running a rollup processor (operator). Aztec stated the affected product is deprecated and unrelated to the current Aztec Network or the AZTEC token. ### Sequencer failure Self sequence (sentiment: good) In the event of a sequencer failure, users can force transactions to be included in the project's chain by sending them to L1. Proposing new blocks requires creating ZK proofs. ### State validation Validity proofs (SN) (No execution delay; sentiment: good) SNARKs are succinct zero knowledge proofs that ensure state correctness, but require trusted setup. ### Data availability Onchain (sentiment: good) All of the data needed for proof construction is published on Ethereum L1. ### Exit window ∞ (sentiment: good) Users can exit funds at any time because contracts are not upgradeable. ### Proposer failure Self propose (sentiment: good) If the Proposer fails, users can leverage the source available prover to submit proofs to the L1 bridge. ## Stage Zk.Money v1 (Aztec v1) is a Stage 2 Appchain ZK Rollup. **The project does not pass the walkaway test**: users are not able to exit in the presence of malicious operators if the Security Council disappears. ### Scope of assessment #### In scope - L1 core contracts - Gas token #### Not in scope - Source code implementation of the spec - Non-gas tokens - Derivation logic spec - Source code to verification keys mapping - Trusted setup Rollup operators cannot compromise the system, but being **application-specific** might bring additional risk. Aztec v2 is a private rollup that allows users to transfer assets privately. Arbitrary smart contracts are not supported. **Note:** We're still in the process of formalizing how to properly integrate appchains in the Stages framework. ### Stage 0 5 requirements met. - Met: A complete and functional proof system is deployed. - Met: The project calls itself a rollup. - Met: State roots are posted to Ethereum L1. - Met: Inputs for the state transition function are posted to Ethereum L1. - Met: A source-available node exists that can recreate the state from Ethereum L1 data. Please note that the ETHBEAT team has not verified the validity of the node source code. [View code](https://developers.aztec.network/#/A%20Private%20Layer%202/zkAssets/emergencyWithdraw) ### Stage 1 5 requirements met. **Principle** - Met: Compromising ≥75% of the Security Council is the only way (other than bugs) for a rollup to indefinitely block an L2→L1 message (e.g. a withdrawal) or push an invalid L2→L1 message (e.g. an invalid withdrawal) with a <7d exit window. **Guidelines** - Met: Users are able to exit without the help of the permissioned operators. - Met: In case of an unwanted upgrade by actors more centralized than a Security Council, users have at least 7d to exit. - Met: The proof system meets the minimum trusted setup requirements defined in the ETHBEAT [trusted setup assessment framework](https://forum.l2beat.com/t/the-trusted-setups-framework-for-zk-catalog/381). - Met: Prover source code is published. ### Stage 2 1 requirement met. - Met: Users can exit through the escape hatch mechanism and the rollup contract is immutable. [Learn more about Stages](https://ethbeat.org/stages). Please keep in mind that these stages do not reflect project security, this is an opinionated assessment of project maturity based on subjective criteria, created with a goal of incentivizing projects to push toward better decentralization. Each team may have taken different paths to achieve this goal. ## Data availability ### All data required for proofs is published onchain All the data that is used to construct the system state is published onchain in the form of cheap calldata. This ensures that it will always be available when needed. **References** - [RollupProcessor.sol#L359 - Etherscan source code](https://etherscan.io/address/0x737901bea3eeb88459df9ef1BE8fF3Ae1B42A2ba#code#F1#L359) Learn more about the DA layer here: [Ethereum](https://ethbeat.org/projects/ethereum) ## State derivation ### Node software There are three ways to run a node and use the escape hatch: By running the [Aztec v2 Ejector](https://github.com/AztecProtocol/aztec-v2-ejector/) during the escape hatch window, 2) by running [falafel](https://github.com/AztecProtocol/aztec-2.0/tree/master/falafel), 3) by running the [SDK](https://developers.aztec.network/#/A%20Private%20Layer%202/zkAssets/emergencyWithdraw) in escape hatch mode and connecting to an [escape hatch server](https://github.com/AztecProtocol/aztec-v2-escape-hatch-server). The two latter methods are no longer recommended by the Aztec team. ### Compression scheme No compression scheme is used. ### Genesis state No genesis state is used. ### Data format The data format used can be found [here](https://github.com/AztecProtocol/aztec-2.0/blob/master/blockchain/contracts/Decoder.sol). ## State validation ### Validity proofs Each update to the system state must be accompanied by a ZK proof that ensures that the new state was derived by correctly applying a series of valid user transactions to the previous state. These proofs are then verified on Ethereum by a smart contract. **References** - [RollupProcessor.sol#L395 - Etherscan source code](https://etherscan.io/address/0x737901bea3eeb88459df9ef1BE8fF3Ae1B42A2ba#code#F1#L395) ## Updates Each date links the update on the HTML page, which also shows its contract diffs. ### [2025-05-12 09:49 UTC](https://ethbeat.org/layer2s/projects/aztecv1?update=869742a5) (1 change) Discovery rerun on the same block number with only config-related changes. ### [2025-07-14 12:44 UTC](https://ethbeat.org/layer2s/projects/aztecv1?update=8c0dcea5) (4 changes) Discovery rerun on the same block number with only config-related changes. ### [2025-05-09 10:53 UTC](https://ethbeat.org/layer2s/projects/aztecv1?update=c44188d8) (high severity, 3 changes) The public address (private key was made public so anyone can operate the chain) set a 7702-authorization to a drainer because there were some minor tokens in the EOA. ### [2024-05-06 14:22 UTC](https://ethbeat.org/layer2s/projects/aztecv1?update=8d31a4ad) (1 change) Ownership of the rollup contract is renounced. ### [2024-03-25 10:52 UTC](https://ethbeat.org/layer2s/projects/aztecv1?update=e150f4b7) (1 change) Rollup processors receive gas reimbursements from the AztecFeeDistributor for having called the processRollup() function. The reimburseConstant, which is a constant added to each dynamically calculated gas reimbursement is now set to 0. Context: Zk.money V1 (this project) is sunset for a long time now. Users can only exit by running a local docker container that runs the rollup. They have to pay the processRollup() transaction fee but get refunded by the AztecFeeDistributor. ### [2024-03-15 09:26 UTC](https://ethbeat.org/layer2s/projects/aztecv1?update=596d0a4a) (1 change) One rollupProvider is added. ### [2024-02-28 11:31 UTC](https://ethbeat.org/layer2s/projects/aztecv1?update=6ba408ab) (3 changes) On Jan 14, 2024 TurboVerifier contract has been replaced with AlwaysReverting contract effectively halting verification process. On Feb 15, 2024 the verifier has been updated to an unverified contract. After 3 minutes it was again updated to a new TurboVerifier. The unverified contract is not similar in any way to the new TurboVerifier. While the new TurboVerifier has basically the same source code as the historical one except some hardcoded values. - the "3 minute" verifier (0xf3761b450571a49fa8e2af6e37e1eb3516209d56) - the new verifier (0x48cb7ba00d087541dc8e2b3738f80fdd1fee8ce8) Everything operation was executed by the same EOA that deployed the entire Aztec Project (0xFcF75295f242C4E87203Abb5d7C9BbEda90a8895). Starting with the transaction to update the verifier to an unverified contract there was 5 additional transactions (six in total). All happened in the span of one hour, all reverting with **proof verification failed**. ### [2024-01-18 13:44 UTC](https://ethbeat.org/layer2s/projects/aztecv1?update=fe4378ed) (2 changes) Verifier has been changed to AlwaysReverting contract. Old verifier persisted for historical reference. ### [2023-11-20 10:32 UTC](https://ethbeat.org/layer2s/projects/aztecv1?update=f80bb45a) (4 changes) Update discovery to include the multisig threshold. ## Operator ### No regular operators Only specific addresses appointed by the owner are permitted to propose new blocks during regular rollup operations. Since EOL, these operators are not regularly processing the rollup anymore. **References** - [RollupProcessor.sol#L97 - Etherscan source code](https://etherscan.io/address/0x737901bea3eeb88459df9ef1BE8fF3Ae1B42A2ba#code#F1#L97) - [RollupProcessor.sol#L369 - Etherscan source code](https://etherscan.io/address/0x737901bea3eeb88459df9ef1BE8fF3Ae1B42A2ba#code#F1#L369) ### Users can force any transaction Because the block production is open to anyone if users experience censorship from the operator they can propose their own blocks which would include their transactions.The private key of one of the permissioned operators is public (first Anvil address), therefore anyone can in principle resume regular operations. No funds need to be deposited to that address since submitting signatures is enough. Every 16h a special 48m window (escape hatch) is open during which any address can propose new blocks. **Risks** - Funds can be frozen if the operator refuses to include their transactions and users lack resources to propose blocks themselves. **References** - [Anvil - a local testnet node toolchain](https://book.getfoundry.sh/anvil/) - [RollupProcessor.sol#L347 - Etherscan source code](https://etherscan.io/address/0x737901bea3eeb88459df9ef1BE8fF3Ae1B42A2ba#code#F1#L347) - [RollupProcessor.sol#L168 - Etherscan source code](https://etherscan.io/address/0x737901bea3eeb88459df9ef1BE8fF3Ae1B42A2ba#code#F1#L168) ## Withdrawals ### Regular withdraw (deprecated) The user initiates the withdrawal by submitting a transaction on L2. When the block containing that transaction is proven on L1 the assets are automatically withdrawn to the user. **References** - [RollupProcessor.sol#LL396 - Etherscan source code](https://etherscan.io/address/0x737901bea3eeb88459df9ef1BE8fF3Ae1B42A2ba#code#F1#L396) ### EOL: Manual withdrawal using Aztec v2 Ejector EOL: Ownership of the rollup contract is irrevocably renounced and operators are not processing the rollup. Assets in the escrow can be manually withdrawn with the [Aztec v2 Ejector](https://github.com/AztecProtocol/aztec-v2-ejector/). **References** - [Aztec v2 Ejector - Codespace template for running the Aztec v2 rollup.](https://github.com/AztecProtocol/aztec-v2-ejector/) ## Other considerations ### Payments are private Balances and identities for all tokens on the Aztec rollup are encrypted. Each transaction is encoded as a zkSNARK, protecting user data. **References** - [Fast Privacy, Now - Aztec Medium Blog](https://medium.com/aztec-protocol/aztec-zkrollup-layer-2-privacy-1978e90ee3b6#3b25) ## Permissions Explore these contracts and permissions in Disco, ETHBEAT's contract explorer: https://disco.ethbeat.org/ui/p/aztec ### Ethereum #### Actors ##### 2 EOAs Addresses: [0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266](https://etherscan.io/address/0xf39Fd6e51aad88F6F4ce6aB8827279cffFb92266), [0xFcF75295f242C4E87203Abb5d7C9BbEda90a8895](https://etherscan.io/address/0xFcF75295f242C4E87203Abb5d7C9BbEda90a8895) Addresses that can propose new blocks during regular rollup operation. Since the private key of one of them is public (first Anvil address), anyone can in principle resume regular operations. Every 16h a special 48m window (escape hatch) is open during which anyone can propose new blocks. ##### Aztec Multisig Addresses: [0xE298a76986336686CC3566469e3520d23D1a8aaD](https://etherscan.io/address/0xE298a76986336686CC3566469e3520d23D1a8aaD) A Multisig with 1/2 threshold. Can update parameters related to the reimbursement of gas to permissioned rollup providers. It doesn't affect the escape hatch mechanism, but it can halt regular operations by setting a reimbursement constant that is too high. Participants (2): [0x1D93fE338A035f297819EA867275661a4f5B4fdD](https://etherscan.io/address/0x1D93fE338A035f297819EA867275661a4f5B4fdD), [0x7fb9f93Cc6614dDd76c893EC8b5310674aC3Fc5f](https://etherscan.io/address/0x7fb9f93Cc6614dDd76c893EC8b5310674aC3Fc5f) ## Smart contracts ![A diagram of the smart contract architecture](https://ethbeat.org/static/images/architecture/aztecv1.dc4bc21f.png) Explore these contracts and permissions in Disco, ETHBEAT's contract explorer: https://disco.ethbeat.org/ui/p/aztec ### Ethereum #### AztecFeeDistributor Addresses: [0x41A57F5581aDf11b25F3eDb7C1DB19f18bb76734](https://etherscan.io/address/0x41A57F5581aDf11b25F3eDb7C1DB19f18bb76734#code) Contract responsible for collecting transaction fees and reimbursing gas to whitelisted Rollup Providers. #### TurboVerifier Addresses: [0x48Cb7BA00D087541dC8E2B3738f80fDd1FEe8Ce8](https://etherscan.io/address/0x48Cb7BA00D087541dC8E2B3738f80fDd1FEe8Ce8#code) Turbo Plonk ZK verifier. #### RollupProcessor Addresses: [0x737901bea3eeb88459df9ef1BE8fF3Ae1B42A2ba](https://etherscan.io/address/0x737901bea3eeb88459df9ef1BE8fF3Ae1B42A2ba#code)